Remove the ConfigMap, RPZ and managed-directory editors the cluster objects replace

Zones, address redirects, inline rules, lists and groups are cluster objects now
(see the previous commits and deploy/MIGRATION.md), so the mechanisms that held
them are gone:

* internal/kubezones and the resolver's service-account access to a ConfigMap,
  the address-overrides read/write path and its poller, the zone-file poller and
  the Local zones editor with its /api/local-zones routes.
* localzone.Managed, the directory of console-written master files, and the
  blocklist.managed_zones key. The resolver now writes no zone data at all; its
  zone hooks only list. The shared half of that file (the record validator, the
  renderer and the round-trip check) stays as zonestate.go, because DNSZone
  rendering is built on it. Its tests are ported to RenderZone, which keeps the
  coverage of every editable record type, wildcards, relative owners, the
  SOA/NS rule and the delegation rule.
* Tests of the removed write paths: the contract test now builds its zone from a
  DNSZone, and a new test pins that every zone write route on the resolver is
  refused and changes nothing.

Standalone installs keep editing master files on disk and SIGHUP, and the
YAML-backed domain, client, upstream and settings editors, which have not moved.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/app/contract_test.go

@@ -2,16 +2,19 @@ package app
 
 import (
 	"bufio"
+	"context"
 	"encoding/json"
 	"io"
 	"net/http"
-	"path/filepath"
 	"sort"
 	"strconv"
 	"strings"
 	"testing"
+	"time"
 
-	"git.k8s-git-k6n.net/mats/fancy-dns/internal/config"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"git.k8s-git-k6n.net/mats/fancy-dns/internal/kubesource"
 )
 
 // The contract tests in this file exist because the console's TypeScript types
@@ -469,21 +472,25 @@ func TestRemainingEndpointKeySets(t *testing.T) {
 // record is the thing the console renders row by row. So this builds a zone
 // through the write endpoint, delegates a name in it, and pins every level.
 func TestZoneEndpointKeySets(t *testing.T) {
-	managed := filepath.Join(t.TempDir(), "zones")
-	h := newHarness(t, func(c *config.Config) { c.Block.ManagedZones = managed })
-
-	write := func(t *testing.T, method, path, body string) {
-		t.Helper()
-		code, out := h.do(method, path, body)
-		if code != http.StatusOK {
-			t.Fatalf("%s %s = %d: %s", method, path, code, out)
-		}
+	client := kubeClient()
+	h := newHarness(t, nil, func(o *Options) {
+		o.Kube = KubeOptions{Enabled: true, Namespace: "dns", Client: client, SyncTimeout: 5 * time.Second}
+	})
+	// A zone with a record and a delegation, from the cluster.
+	if _, err := client.Resource(kubesource.ZoneGVR).Namespace("dns").Create(context.Background(), kubeObj("DNSZone", "console", map[string]any{
+		"zone": "console.test",
+		"records": []any{
+			map[string]any{"name": "@", "type": "NS", "value": "ns1.console.test."},
+			map[string]any{"name": "www", "type": "A", "ttl": int64(60), "value": "10.9.9.9"},
+			map[string]any{"name": "sub", "type": "NS", "value": "ns1.sub.console.test."},
+		},
+	}), metav1.CreateOptions{}); err != nil {
+		t.Fatal(err)
 	}
-	// A zone needs a server list before it can hold anything, and a
-	// delegation is the other way to start one.
-	write(t, http.MethodPost, "/api/zones/records", `{"zone":"console.test.","name":"console.test.","type":"NS","value":"ns1.console.test."}`)
-	write(t, http.MethodPost, "/api/zones/records", `{"zone":"console.test.","name":"www.console.test.","type":"A","ttl":60,"value":"10.9.9.9"}`)
-	write(t, http.MethodPost, "/api/zones/delegations", `{"zone":"console.test.","name":"sub.console.test.","targets":["ns1.sub.console.test."]}`)
+	eventually(t, "the zone to be listed", func() bool {
+		_, body := h.get("/api/zones")
+		return strings.Contains(string(body), "console.test.")
+	})
 
 	t.Run("zones", func(t *testing.T) {
 		code, body := h.get("/api/zones")